Threat Intelligence Brief
Curated summary with source attribution
Source: teiss.co.uk
Threat Risk: High
Victim: Marathon Health
Incident: Unauthorized access to a cloud-hosted application via stolen employee credentials.
Impact: Exposure of names, dates of birth, and Social Security numbers for over 5.6 million individuals.
Attacker: Unidentified threat actor
Analysis: The attacker used social engineering to pose as an IT worker and steal employee credentials. By gaining access to a cloud-hosted application, the actor was able to export the sensitive PII of millions of patients. This incident underscores the persistent risk of credential theft and the dangers of insufficient identity verification for administrative roles.
Recommendations: Implement phishing-resistant multi-factor authentication (MFA) for all cloud-hosted applications.; Establish strict, multi-channel identity verification protocols for IT support and administrative requests.; Apply the principle of least privilege to limit the amount of data a single compromised account can export.
Source: Teiss
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source